News for hackers. Stuff that matters.

A comment on What we learned after I deleted the main production database by mistake. Parent comment

Re:What we learned after I deleted the main production datab... by partdavid on Monday September 19, 2022 @06:23PM (#32904936)
I mean, it shouldn't really be very easy to even get a read-write token to a production database, unless you're a correctly-launched instance of a publisher service. This screams to me that they're ignorant of, and probably very sloppy with, access control up and down their stack.
[ Parent | on HN ]
Re:What we learned after I deleted the main production datab... by thayne on Monday September 19, 2022 @07:22PM (#32905505)
This is actually discussed in the article. Basically, at least with older versions of elasticsearch, without X-pack elasticsearch didn't have granular permissions. Either you had access or you didn't.
[ Parent | on HN ]
Re:What we learned after I deleted the main production datab... by twblalock on Monday September 19, 2022 @08:05PM (#32905866)
This is when you put a gateway-type layer on top of a datastore that enforces your own company-specific authn/authz.

In this case, the datastore uses a REST API, so that should be fairly easy to implement. You could even do it in Nginx or Envoy.

[ Parent | on HN ]